CVE-2026-123569 PUBLISHED

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.

• elliott-with-the-longest-name-on-github remediation developer

• GitHub Security Advisory (GHSA-33hq-fvwr-56pm)
• VulnCheck Advisory: Devalue before 5.6.3 Denial of Service via Sparse Array Serialization

• Allocation of Resources Without Limits or Throttling CWE